October, 2009

  • The Three UC Amigos

    Exchange 2010 Federation Part I

    • 1 Comments

    So we must be talking about Identity Management. Nope.

    In this case we are talking about federating calendars between on-premises and cloud services such as Outlook Live and Exchange Online (when our back-end moves to Exchange 2010). This can also be used to share calendars between your school and partners to shared their availability information (free/busy) for scheduling meetings.

    In previous editions of Exchange we had to use tools like the inter-org replication tool to provide this type of integration as well as Active Directory Trust in both ways which most times has been undesirable with 3rd parties or even within school systems.

    In Ex2007 we were able to change the entire model from system folder (free/busy) to looking at experiences with Exchange Web Services (EWS), availability Services, and the Client Access Server (CAS). So to configure availability services between forest you could do this:

    Add-AvailabilityAddressSpace -ForestName "contoso.edu" -AccessMethod PerUserFB -UseServiceAccount $true

    More info on this can be found here.

    So now we jump to light speed and we now have “Federated Sharing”. So yes it’s federated but no it’s not identity management. This now allows use to enable users to share information with recipients with external federated organizations such as (Outlook Live, Exchange Online). Federating Sharing uses the Microsoft Federation Gateway (MFG), as the trust broker between two federated organizations.

    Notes: Exchange Server 2010 uses Microsoft Federation Gateway (MFG), an identity service that runs in the cloud, as the trust broker.  The trust allows users authenticated by Active Directory , known as the identity provider (IP), to be issued Security Assertion Markup Language (SAML) delegation tokens by MFG. The delegation tokens allow users from one federated organization to be trusted by another federated organization. With MFG acting as the trust broker, organizations are not required to establish multiple individual trust relationships with other organizations.

    The requirements for this with Outlook Live and Exchange Online are the following:

  • An Exchange 2010 Client Access Server (CAS) exists in the Exchange organization
  • A Federation Trust has been created
  • The Federated Organization Identifier (OrgId) has been configured. Domains used for generating users' e-mail addresses have been added to the OrgId.
  • STEP 1 – Setting up Federation

    To setup federation sharing the customer is required to use a public cert with these requirements for integration with the MFG.

  • Trusted Certification Authority   The certificate must be signed by a trusted certification authority (CA). For a list of trusted certification authorities, see Trusted Root Certification Authorities For Federation Trusts [ http://technet.microsoft.com/en-us/library/ee332350(EXCHG.140).aspx ] .
  • Subject Key Identifier   The certificate must have a Subject key Identifier (SKI) field. Most X.509 certificates issued by commercial certification authorities have a SKI.
  • CryptoAPI CSP   The certificate must use a CryptoAPI cryptography service provider (CSP). Certificates that use CryptoAPI Next Generation (CNG) providers are not supported for Federation. If you use Exchange to create a new certificate request, a CryptoAPI provider is used.
  • RSA signature algorithm   The certificate must use RSA as the signature algorithm.
  • Exportable Private Key   The private key used to generate the certificate must be exportable. You can specify that the private key of a certificate be exportable when you create the certificate request using the New Certificate wizard in EMC, or the New-ExchangeCertificate [ http://technet.microsoft.com/en-us/library/aa998327(EXCHG.140).aspx ] cmdlet.
  • Current certificate   The certificate must be current. You can't create a Federation Trust using a certificate that is expired or revoked.
  • Enhanced Key Usage   The certificate must include the Enhanced Key Usage type Client Authentication (1.3.6.1.5.5.7.3.2). This usage type is inteded for the purpose of proving your identity to a remote computer. If you use Exchange tools to generate the certificate request, this usage type is included by default.
  • Since the certificate is not used for authentication, it does not have any subject name or subject alternative name requirements. You can use a certificate with a subject name that is the same name as the hostname, the domain name, or any other name. Only one certificate is required for the Federation Trust. Exchange automatically distributes the certificate to other Exchange 2010 servers in the organization.

    Now that we have a cert I’ll talk about configuration with gateway in Part II.

  • The Three UC Amigos

    Exchange 2010 Federation Part III

    • 0 Comments

    Federated Sharing offers two ways to share information with recipients in external organizations (Outlook Live/Exchange Online): 1) Organization relationships and 2) Sharing policies.

      Organization Relationships

    You can select between the following levels of availability information shared using an organization relationship:

    • Free/busy access with time only  
    • Free/busy access with time, plus subject and location 

     

    Creating an organization relationship

    What’s great about this is you can scope which users to communicate with. It could be org-wide or you can specify a specific group like faculty.  Availability information for your users who are member of the selected distribution group will be visible to all users in the external organization. Similarly, the external organization can create an organization relationship with your organization, and make the availability information of selected or all users available to users in your organization.

    Once the relationship is established the autodiscover service is used to find the published availability service for the external web service. You can also configure this manually.

    Again you can create the relationship either with EMC or the shell. The shell will use the New-OrganizationRelationship cmdlet.

     

    Sharing Policies

    Sharing policies are created by administrators to allow users to share calendar and contact information that resides in the respective folders with users in external federated organizations. Sharing policies contain pairs of domain names and the sharing actions that are allowed for users from that domain. You can specify the following actions that apply to the external domain specified in a sharing policy.

    • Calendar sharing with free/busy information only
    • Calendar sharing with free/busy information, plus subject and location
    • Calendar sharing with free/busy information plus subject, location and body
    • Contacts sharing
    • Calendar sharing with free/busy information only, Contacts sharing
    • Calendar sharing with free/busy information, plus subject and location, Contacts sharing
    • Calendar sharing with free/busy information plus subject, location, and body, Contacts sharing

    Creating a Sharing Policy

    When creating a sharing invite for recipients from the external domain, your users can select the level of details they want to share, provided the action is allowed by the sharing policy that's applicable to the user.

    Sharing policies can be disabled or enabled. When a sharing policy is disabled, sharing is stopped for all users who have that policy applied.

    Once this is complete we have federated sharing for free/busy. More information can be found in Technet: http://technet.microsoft.com/en-us/library/dd351109(EXCHG.140).aspx

  • The Three UC Amigos

    Does OCS R2 provide ACD functionality?

    • 0 Comments

    I was asked this by a university in Colorado:

     

    The answer is not directly out of the box however there is a feature in OCS 2007 R2 that provides a subset of ACD features (mostly departmental ACD features) called a Response Group Service.

     

    What is a Response Group Service?

    A new feature provided in OCS 2007 R2 is called the Response Group Service. It provides inbound call routing capabilities to call agents. There is no additional license required for this feature.

     

    Response Group Service features include:

    •Hunt groups and basic IVRs

    • Support for end-users managing RGS

    • Integration with OCS presence

    • Speech recognition and Text to Speech in 12 languages

    • Music on hold

    • Basic CDRs

    What components make up a Response Group?

    image

    There are four components of a response group:

     

    Response Group – lives in AD as a contact object, 4 templates to chose from:

     

    Basic hunt group

    Enhanced hunt group – basic hunt group+hold music, welcome greeting

    One level basic hunt group – enhanced hunt group+single level IVR

    Two level basic hunt group – enhanced hunt group+double level IVR

    image

     

    Queue – set up for calls that aren’t routed yet, can have multiple agent groups assigned to a queue

    Agent Group – groups of agents that queues point to, configure routing methods:

    parallel

    serial

    round robin

    longest idle

    image

    Agent – users that Response Group routes calls to, either informal, formal or not active for agent group participation

     

    How do I deploy the RGS?

    RGS is installed by default with both Enterprise and Standard Edition OCS 2007 R2.

    image

    You manage queues, agent groups and agents via the MMC snap-in that gets installed when you install the OCS R2 administration tools.

    image

    image

     

    You manage Response Groups via a web page. The RGS URL on the Front End format is the following: https://srv/Rgs/Deploy/Default.aspx

    image

    Contact objects used by the Response Group are created with the RGSCOT.exe command line tool which is installed with the OCS R2 administration tools.

    image

     

    What does the end user calling into a Response Group look like?

    The end user would see response groups appear as searchable contact group associated with a cog icon.

    image

    What does the Agent experience look like?

    The agent would receive a call on the left with “Transferred via 'response group name’” along with the information that the caller selected via IVR or DTMF for context for the agent.

    image

     

    What type of reporting can I do with the RGS?

    There are some basic RGS reporting tools available for OCS R2:

     

    Install ArchiverCDRReporter OCS 2007 R2 Resource Kit tool here.

    RGS data is stored in the CDR database along with all other CDR calls. Each call to a Response Group will generate three dialogs in the CDR database:

    Dialog 1 - The caller calls RGS

    Dialog 2 - RGS calls the agent

    Dialog 3 - RGS connects the agent to the caller

    Report entry “Wait time of call” = Dialog 1

    Report entry “Length of call” = Dialog 3

     

    Other tips/tricks using RGS?

    • If you are trying to access the RGS webpage as a domain admin be sure to add your account to the RTCUniversalServerAdmins group
    • RGS manager role does not have access to manage Queues
    • Changes made to Response Groups take a few minutes to take effect
    • Deactivating RGS causes its contact objects to be deleted
    • There is a OCS 2007 R2 resource kit tool to export/import Response Groups (including contact objects)

     

    What are my options if I want full ACD/Contact Center functionality with my OCS R2 voice rollout?

    There are a few partners in this space including Aspect and Interactive Intelligence that can provide ACD Contact Center functionality for OCS 2007 R2.

  • The Three UC Amigos

    Exchange 2010 Federation Part II

    • 0 Comments

    OK. Now we have a cert.

    Prerequisites

  • The domain used for establishing a federation trust should be resolvable from the Internet.
    This requires that the domain be registered with a domain registrar, and the DNS zone for the domain be hosted on a DNS server accessible from the Internet. If the organization receives Internet e-mail for the domain, these requirements are already met.
  • A valid X.509 certificate issued that meets the requirements for federation trusts.
    The certificate must be issued by a Certification Authority (CA) trusted by the Microsoft Federation Gateway. This certificate will be deployed automatically to all Client Access and Hub Transport servers accessible by the federation trust task
  • To implement you can use EMC or Shell. From shell the cmd is:

    Get-ExchangeCertificate | where {$_.IsSelfSigned -eq $false} | fl

    Here it is from EMC. Right click on the organization and the wizard comes up for adding your certificate. Browse and Add your certificate and click on New. On the next page ensure it’s completed successfully.

    image

  • The Three UC Amigos

    Looking for OCS 2007 R2 voice training for your telecom staff?

    • 0 Comments

    If you are looking for some voice specific training for your telecom team for OCS R2 there is an unique offering over at www.OCSforum.com.  Tom Cross, the CEO of OCSForum, has setup hosted sandbox labs to test your voice configurations as well as in person training and online training.

     

    image

    Sample of Live Online training

    image

    Accompanying animations that show OCS voice scenarios


    Here are some sample course outlines:

     

    OCS 101 course with 5 day virtual lab:

    Explore Microsoft’s OCS-Office Communications Server features, concepts, call flows, configurations and other issues for evaluation and implementation.
    ·        Review the fundamentals of IP-Internet Protocol and platforms required for high performance SIP-Session Initiation Protocol, IT-Internet Telephony or VoIP-Voice over Internet Protocol systems.  This includes soft switches, gateways, routers, services and other critical components.
    ·        Explore business applications and opportunities.  Review what customers are buying today and why they are buying.  In addition, emerging “killer applications” will be explained in depth.
    ·        Quickly grasp complex subjects such as H.323, MGCP-Media Gateway Control Protocol and SIP.  As SIP-Session Initiation Protocol emerges are the key VoIP communications protocol, discover how this technology will impact all voice communications systems from key, PBX-Private Branch eXchange, IP-Internet Protocol-PBX, hosted, managed and other systems.
    ·        Understand basic and advanced SIP-VoIP concepts features.  From hosted, managed, IAS-Integrated Access Service, and IP-PBX, quickly understands “what’s-what” for different customer applications and business models.
    ·        Probe the issues behind Integrated and Converged Access.  Understand when and why organizations need a converged access solution.
    ·        Learn why “network assessment” is critical to any SIP-VoIP implementation and why this step cannot be overlooked.
    ·        Address the issue of QoS-Quality of Service by overcoming jitter, echo, noise and other network problems.  Review the role of RTCP-Realtime Transport Control Protocol and other tools to monitor and maintain high performance VoIP networks.
    ·        Understand the functions of the new communications “toolbar.”  See how the benefits of “unified communications” as they improve business operations.
    ·        Assess the Top-10 issues why SIP trunking and hosted VoIP is more than “dial-tone,” and how it can represent change in the business and business model of even the smallest enterprises.  Discuss and explore new ways to improve fundamental business processes.
    ·        Explore how a SIP-VoIP call is processed and review potential security attacks.   Discover how SPIT-Spam over Internet Telephony, VOMIT-Voice Over Misconfigured Internet Telephony, DOS-Denial Of Service and other terrorist attacks can target not just data, but voice packets.
    ·        Review SIP and SIP Trunking and all the implications and applications from TCO-Total Cost of Ownership to QoS-Quality of Service.  SIP Trunking is the most profound new form of telecommunications since POTS-Plain Old Telephone Service. 

     

    Check it out a 60 second sample of what the animated graphics that accompany the course:

    http://www.ocsforum.com/news/gateway-ocs/

    Here is a sample of the OCS training:

    http://www.ocsforum.com/index.php?option=com_content&view=article&id=54&Itemid=66

     

     

    OCS R2 labs (can be in person or via the web):

     

    Sample lab course:

    OCS and Voice Integration


    ·        Integration with PBX systems such as Avaya, Nortel, Mitel, ShoreTel, etc.
    ·        Media Gateways
    ·        PSTN-Public Switched Telephone Network Integration
    ·        SIP-Session Initiation Protocol Trunking
    ·        Call reports and call logs
    ·        Call testing

     

    To view the agendas visit here.

  • The Three UC Amigos

    Get some free Exchange 2010 training and chapters while it lasts

    • 1 Comments

    Now that we have RTMed Exchange 2010 – where can I get some training?

    Well, if you act now you can use the free Exchange Server 2010 e-Learning Clinics for a limited time:

    Learn about the new unified messaging features, effective deployment scenarios, development platform options, and more.

     

    Take a look at some chapters from the upcoming successful book series: ‘Exchange 2010 Pocket Consultan’t chapters:

    Microsoft prePress chapters

    Microsoft prePress is early content, straight from the source. What makes it "prePress"? Each draft chapter comes fresh from the minds and laptops of our respected authors, before we have edited and debugged the content. Microsoft prePress chapters are a great way to get cutting-edge information right now, just when you need it!

    Microsoft Exchange Server 2010 Administrator’s Pocket Consultant
    By William R. Stanek
    Download free Microsoft prePress chapters of this Microsoft Press book to get an introduction to Exchange Server 2010 administration. These chapters can help you get up to speed quickly, and they are an excellent reference to have on hand as you work.

    Chapter 1: Exchange Server Administration Overview, and Chapter 6: Mailbox Administration

    Download PDF file (903 KB)

    Download XPS file (10.3 MB)

     

    View the Exchange 2010 launch here:

    http://vepexp.microsoft.com/thenewefficiency

  • The Three UC Amigos

    Federate with Google Talk and Jabber and even AOL without a PIC license

    • 1 Comments

    A lot of schools have been asking me when our XMPP gateway was coming out and it finally hit the web today.

    The XMPP Gateway federation interoperability has been tested between OCS 2007 R2 as well as OCS 2007 and Jabber XCP Server 5.4 and the current version of Google Talk.  The OCS 2007 R2 XMPP Gateway is supported by Microsoft Support.

    The XMPP Gateway is licensed as Additional Software to OCS 2007 R2, meaning there is no additional license cost associated with deploying the Gateway for OCS 2007 R2 licensees.

    We posted our XMPP Gateway for download here.

    In other big news today, you no longer need a PIC license for federation with AOL IM users! Customers qualify for federation with AOL if they have Office Communications Server 2007 R2 Standard CAL or active Software Assurance on their current LCS/OCS license. The only PIC license remaining is for federation with Yahoo. Check with your LAR for the 50% PIC price reduction changes for Yahoo. Read more about it here.

  • The Three UC Amigos

    Da Dump

    • 0 Comments
     

    Introduction

    The Dumpster. In Exchange 2010 we introduce the new Dumpster 2.0. This is a completely different Dumpster than what we’ve had in the past.

    An end user can do a soft delete or a hard delete on a message. The soft delete is when the item has been deleted from the deleted items folder – this item is placed in the dumpster. The hard delete is when an item has been marked for purge out of the store. There is also a hard delete via Outlook when a user uses Shift-Delete and this places the item directly in the dumpster bypassing the deleted items folder.

    To help reduce the burden for the administrator most of my customers change the default from 14 days to 30 days and provide guidance for users to check the deleted items folder to recover mail vs. going to tape to recover an email.



    The Exchange team has a great article that describes the new Dumpster in detail and how Litigation hold and single item recovery are handled in Dumpster 2.0. The article is linked here for your consumption.

    http://msexchangeteam.com/archive/2009/09/25/452632.aspx

  • The Three UC Amigos

    Exchange 2010 RTM. Woohoooo!!!!

    • 0 Comments

    General Availability early Nov. http://msexchangeteam.com/default.aspx 

    Enough said. I’m excited.

  • Page 1 of 1 (9 items)